dhi.io/gitlab-runner-helper
GitLab Runner Helper 18.x
18, 18-debian, 18-debian13, 18.11, 18.11-debian, 18.11-debian13, 18.11.4, 18.11.4-debian, 18.11.4-debian13
sha256:6f7b5a0a8019d7c9ff33b563d3cd7e658bc928461529ccce161be841eb8067f4
Manifest digest:sha256:d2b830f38a99fa14c512cb034a4ed1a132f9d2d01fd5f6f8741f4c1f15afebed
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/gitlab-runner-helper:182. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/gitlab-runner-helper:18 --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/gitlab-runner-helper@sha256:e6de86c6959accdd96cb2220f5db65bb6dba21ad20390b9f7122dd425e7487ca |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/gitlab-runner-helper@sha256:73d8e7e05355ce035ba8836203e49973838cd4e6ff208ab34e97c0bc189cc318 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/gitlab-runner-helper@sha256:3fec5a8203dbab2debf17508b844c107f57326853bf8609d146a7d4bd60ab5bb |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/gitlab-runner-helper@sha256:9d99b2e4542fd98f0014043ba9a746a28a71f35fa47b745ba1581a4e64c9e64c |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/gitlab-runner-helper@sha256:a6367ea79049e5db640cf7af1d4157206400a9b3ad676b54aedec1096ff4441c |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/gitlab-runner-helper@sha256:a24c55324786a77a63ab17ee57a19dfa46c34714931fac224d5f22da5ab058a6 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/gitlab-runner-helper@sha256:75c094d1d837c59bdf92b23d956734e1d7cc94b65878a239bd17da0f0d61d18e |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/gitlab-runner-helper@sha256:fd9af25dbe5f49f8d4eff33111692f4856bfef92fc0974c6a5ea93d2c7eb3a8b |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/gitlab-runner-helper@sha256:ce5f7b7361110b6d014d073d6e217b7dbeeb6a60b2a779fc2d0e3e1add89acee |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/gitlab-runner-helper@sha256:96124ba8ce75b82a6d1d4a1a605de31c29fb148948a39f320f6b28e9b7f7570c |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/gitlab-runner-helper@sha256:a0abc146119ebd3bda1164110358e8ed1790208e4f4fc5b8a7b98b96ea0034db |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/gitlab-runner-helper@sha256:d1dcb8a8cf84596704745da2420310b72e434968c759062e13bce28aa1b34e9e |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/gitlab-runner-helper@sha256:0b3da52be3336b821cf44850751edb4efd444de5aed44c95fbaa45bf1f4f7e08 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/gitlab-runner-helper@sha256:69a9f13c03da30cf462804f568ebf39c7b61cb2a7a3ef34e26d1cea834c2bbae |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/gitlab-runner-helper@sha256:52597341c90038f3f828cf24e99600408c07c880dd87e878dda2ca3d61fcc8ab |